OpenAI Codex CLI rust-v0.147.0

OpenAI Codex CLI rust-v0.147.0 was released on August 7, 2026.

Summary

OpenAI Codex CLI rust-v0.147.0 now lets you install plugins from multiple sources and organize conversations into persistent sections for easier browsing. We've also added automatic approval options and improved security by redacting sensitive information from command history....

Release Notes

New Features - Install portable Agent Plugins and search across local, personal, workspace, and remote plugin catalogs. (36544, 36409, 36919, 36796) - Organize conversations into persistent, manually ordered sections and browse long transcripts incrementally. (35722, 36007, 36380, 36948, 36950) - Enable automatically reviewed approvals with the new --approve-for-me CLI flag. (36373) - Import Cursor-managed skills and synchronize changes to imported Claude and Cursor conversations without creating duplicates. (36361, 36356, 35623) - Support the opt-in MCP 2026-07-28 protocol, including paginated discovery, multi-round requests, and non-blocking server startup. (35724, 35725, 35590, 35742) - Enable cached web search and remote conversation compaction for Amazon Bedrock. (36938, 36981) Bug Fixes - Redact secrets and complete bearer tokens from displayed commands and replayed conversation history. (36893, 36908) - Prevent lost or stalled terminal input when focus returns, MCP servers initialize, or Ghostty handles keyboard shortcuts. (35649, 35957, 36834) - Correct rendering and cursor positioning for Japanese characters, emoji, hyperlinks, and text near viewport boundaries. (35960, 35962, 37166) - Properly interrupt Windows background processes and handle Windows filesystem paths consistently. (35655, 35851, 37129) - Require explicit trust for unfamiliar local projects and enforce managed authentication restrictions before credentials are used. (36960, 37132) - Harden plugin isolation and deny network access when policy updates fail. (37027, 36967, 36037) Documentation - Improve the bundled OpenAI documentation skill with targeted official-source lookup and clearer guidance for Codex, model selection, and API workflows. (36014) Chores - Upgrade the MCP SDK to 3.0.0, Ratatui to 0.30.2, and V8 to 150.4.0. (36001, 35959, 35831) - Secure macOS release notarization using Azure Key Vault instead of exporting private signing keys. (37154) - Remove the deprecated codex exec --full-auto flag; use --sandbox workspace-write instead. (36054) - Stop publishing redundant Linux bundle archives; use the standard codex-package-<target> release archives. (36342) Changelog Full Changelog: https://github.com/openai/codex/compare/rust-v0.146.0...rust-v0.147.0 - 35590 Expose cached MCP tools before server startup @copyberry - 35594 Recommend longer waits in the v2 waitagent schema @copyberry - 35595 Allow alpha hotfix versions in R2 releases @copyberry - 35597 Add metrics for extension-rendered skill catalogs @copyberry - 35607 Record metrics for empty skill catalogs @copyberry - 35608 Support model-owned token budget defaults @copyberry - 35621 Skip restored token usage replay for exec resumes @copyberry - 35623 Parse Claude and Cursor session records separately @copyberry - 35642 Make OpenTelemetry provider shutdown idempotent @copyberry - 35644 Preserve thread metadata when rollout files are missing @copyberry - 35649 Preserve TUI input when terminal focus returns @copyberry - 35652 Enable network policy callbacks for remote exec @copyberry - 35653 Test developer instruction inheritance for multi-agent workers @copyberry - 35655 Terminate Windows non-TTY processes on interrupt @copyberry - 35656 Preserve multi-agent settings across config representations @copyberry - 35661 Place host skills before permission instructions @copyberry - 35663 Evaluate character matching over skill routing metadata @copyberry - 35665 Fix the async watcher test harness on Windows @copyberry - 35668 Expose the network proxy spec constructor @copyberry - 35670 Raise the Windows exec yield floor to 10 seconds @copyberry - 35671 Route curated plugins by authentication mode @copyberry - 35675 Prepare MCP and plugin recommendations concurrently @copyberry - 35678 Preserve paginated thread metadata across resumes @copyberry - 35685 Load cloud-managed profiles for codex sandbox @copyberry - 35688 Point crossterm patch to the OpenAI OSS fork @copyberry - 35689 Preserve item timestamps in thread history projections @copyberry - 35691 Include empty-preview threads in relationship listings @copyberry - 35693 Refresh the subagent picker in the background @copyberry - 35695 Honor the configured SQLite home in the logs client @copyberry - 35708 Add configurable developer instructions for v2 subagents @copyberry - 35715 Support streaming bodies in route-aware HTTP requests @copyberry - 35717 Reuse route-aware clients for OpenAI file uploads @copyberry - 35720 Upgrade rmcp to 3.0.0-beta.3 @copyberry - 35721 Honor disabled code mode fallback without a process host @copyberry - 35722 Add persisted sections for organizing threads @copyberry - 35724 Add MCP 2026-07-28 discovery support @copyberry - 35725 Complete MCP 2026 client support @copyberry - 35738 Add bounded metadata for executed tool calls @copyberry - 35742 Avoid blocking turns on optional MCP startup @copyberry - 35744 Keep agent registry identities consistent @copyberry - 35766 Emit host skill budget warnings from world state @copyberry - 35769 Share the skills budget across host and executor catalogs @copyberry - 35772 Throttle models cache TTL renewals @copyberry - 35773 Scale skill metadata budgets with context windows @copyberry - 35777 Resolve MCP tool catalogs concurrently @copyberry - 35779 Load thread titles concurrently during session startup @copyberry - 35785 Support self-serve Business ProLite accounts @copyberry - 35787 Gate paginated thread history on the state database @copyberry - 35794 Wait for MCP readiness in the curated sync test @copyberry - 35802 Tag reports with the selected turn's model and effort @copyberry - 35806 Route MCP OAuth through configured HTTP clients @copyberry - 35814 Use configured HTTP clients for all MCP OAuth requests @copyberry - 35818 Advance latest-alpha-cli after release publishing completes @copyberry - 35821 Use the shared HTTP client for TUI network checks @copyberry - 35825 Use the shared HTTP client for announcement tips @copyberry - 35828 Enforce centralized SQLite connection creation @copyberry - 35830 Route WebRTC sideband joins to the Realtime API @copyberry - 35831 Update rustyv8 to 150.4.0 @copyberry - 35835 Track parent turns for nested Codex requests @copyberry - 35836 Clean up cancelled MCP elicitation requests @copyberry - 35837 Expose plugin eligibility metadata in app-server summaries @copyberry - 35839 Decouple recommended plugins from tool suggestions @copyberry - 35840 Handle legacy MCP discovery prevalidation errors @copyberry - 35843 Tie remote exec servers to their parent stdin @copyberry - 35845 Support plaintext collaboration tool messages @copyberry - 35850 Preserve foreign paths in background terminal listings @copyberry - 35851 Normalize Windows namespace paths in path URIs @copyberry - 35854 Box app-server event payloads @copyberry - 35856 Resolve imported connectors by MCP server name @copyberry - 35857 Add Bazel unit test targets for Rust binaries @copyberry - 35859 Expose plugin installation timestamps in app-server summaries @copyberry - 35870 Include session titles in external agent import history @copyberry - 35874 Mark the primary environment in model context @copyberry - 35875 Allow environment readiness updates in place @copyberry - 35878 Use step environments for MCP file uploads @copyberry - 35886 Show blocked goals as stalled in the TUI @copyberry - 35887 Clean up side conversations in the background @copyberry - 35895 Inherit ready step environments when spawning agents @copyberry - 35937 Let unrelated tools run while MCP servers start @copyberry - 35941 Bound MCP namespace descriptions @copyberry - 35942 Update tests for current tool call and app-server event types @copyberry - 35944 Report direct input capability for listed subagents @copyberry - 35957 Fix TUI input queue handling during MCP startup @copyberry - 35959 Upgrade Ratatui to 0.30.2 @copyberry - 35960 Preserve hyperlink cell widths during terminal diffing @copyberry - 35962 Fix TUI layout for halfwidth Japanese sound marks @copyberry - 35982 Avoid cloning rollout history when truncating forks @copyberry - 35989 Display title-only reasoning summaries in the TUI @copyberry - 35990 Test exec-server compatibility across Codex versions @copyberry - 35992 Group external agent config migration into a module @copyberry - 35997 Remove obsolete rustyv8 146.4.0 Bazel targets @copyberry - 36001 Upgrade rmcp to 3.0.0 @copyberry - 36002 Resolve MCP file uploads with environment-native paths @copyberry - 36006 Reduce response serialization and rollout scan overhead @copyberry - 36007 Add persisted manual ordering for thread sections @copyberry - 36008 Route pet asset downloads through the shared HTTP client @copyberry - 36011 Share optional MCP startup grace across connection sets @copyberry - 36014 Refine OpenAI docs skill source routing @copyberry - 36020 Avoid cloning ignored analytics notifications @copyberry - 36030 Increase the app-server tracing test stack size @copyberry - 36031 Load cloud-managed servers in MCP CLI commands @copyberry - 36033 Use the shared HTTP client in codex-protocol @copyberry - 36035 Exit the stdio app-server when its connection closes @copyberry - 36036 Allow naming forked chats from the TUI @copyberry - 36037 Deny network access when an allow amendment fails @copyberry - 36039 Limit MCP catalog pagination @copyberry - 36043 Document the Responses API proxy reqwest exception @copyberry - 36045 Distinguish unknown MCP authentication status @copyberry - 36047 Extract MCP environment headers into a local variable @copyberry - 36049 Keep tool-call metrics out of Statsig exports @copyberry - 36051 Avoid overwriting symlinked migration targets @copyberry - 36054 Remove legacy --full-auto handling from codex exec @copyberry - 36055 Expose MCP read-only hints in tool call items @copyberry - 36076 Remove codex-core's direct reqwest dependency @copyberry - 36078 Route Ollama through the shared HTTP client @copyberry - 36083 Handle fractional rate limits in thread history projection @copyberry - 36092 Correlate image requests and explicit interrupts with turns @copyberry - 36119 Unify tool runtime assembly before router construction @copyberry - 36120 Delegate readiness waits to tool runtimes @copyberry - 36121 Sandbox executor skill resource reads @copyberry - 36124 Respect filesystem permissions during capability discovery @copyberry - 36127 Centralize tool registration and protect host tools @copyberry - 36128 Preserve delegated tasks across remote compaction @copyberry - 36129 Resolve normalized tool name collisions in code mode @copyberry - 36133 Preserve executor workspace permissions for applypatch @copyberry - 36138 Isolate apply-patch permission test variants @copyberry - 36139 Bound the code mode output termination test @copyberry - 36140 Wait for memory consolidation shutdown before finishing jobs @copyberry - 36146 Stabilize approval scenario tests @copyberry - 36148 Harden the file change approval integration test @copyberry - 36149 Strengthen session file change approval coverage @copyberry - 36165 Stabilize file approval replay test @copyberry - 36166 Make pending realtime sideband test deterministic @copyberry - 36167 Harden the auto-review model override test @copyberry - 36168 Make tool telemetry tag collection synchronous @copyberry - 36171 Test workspace-root patch protection for metadata @copyberry - 36177 Test remote Guardian network approval scoping @copyberry - 36181 Record attempted tool calls in response metadata @copyberry - 36183 Use permission profiles throughout sandbox execution @copyberry - 36184 Coalesce concurrent remote metadata requests @copyberry - 36187 Refresh environment dates from the configured clock @copyberry - 36188 Make thread history projection resilient to malformed rollouts @copyberry - 36191 Label explicit skill injection metrics @copyberry - 36194 Avoid shifting bytes in streaming output buffers @copyberry - 36207 Record normalized sandbox violation events @copyberry - 36212 Precompute app-server protocol exports @copyberry - 36217 Run code mode exclusively through the standalone host @copyberry - 36218 Expose connector candidates in external agent detection @copyberry - 36221 Ignore passthrough metadata when reconciling rollout items @copyberry - 36223 Preserve executor paths in read command actions @copyberry - 36228 Support Enterprise automation account plans @copyberry - 36237 Ignore symbolic slash-tmp permissions on Windows @copyberry - 36239 Refresh precomputed app-server protocol exports @copyberry - 36264 Prefer the bundled resource for the code mode host @copyberry - 36271 Derive report prompt hashes from persisted rollouts @copyberry - 36306 Restrict hosted MCP credentials to local environments @copyberry - 36309 Use the host skill provider catalog in world state @copyberry - 36310 Isolate MCP OAuth credentials by environment @copyberry - 36311 Include skills in debug prompt input output @copyberry - 36327 Preserve discovery order for host skill path aliases @copyberry - 36329 Restrict shellcommand to a single local environment @copyberry - 36336 Detect connectors used in external agent sessions @copyberry - 36339 Enable skills in the MCP server @copyberry - 36342 Stop publishing legacy Linux bundle archives @copyberry - 36350 Require explicit sandbox permissions with shell justifications @copyberry - 36351 Use model catalog collaboration mode messages @copyberry - 36354 Pass sessions directly to session tasks @copyberry - 36355 Keep MCP tool calls bound to their thread @copyberry - 36356 Sync updates to imported external agent sessions @copyberry - 36357 Use the step-scoped router for tool execution @copyberry - 36359 Consolidate MCP config editing in codex-core @copyberry - 36360 Use MCP bindings as the step tool catalog @copyberry - 36361 Migrate Cursor-managed skills into Codex @copyberry - 36364 Move skill catalog rendering out of core @copyberry - 36365 Add strict automatic review for MCP elicitations @copyberry - 36367 Keep effective tool exposure in the registry @copyberry - 36372 Run native Windows Bazel tests with MSVC @copyberry - 36373 Add an --approve-for-me CLI flag @copyberry - 36374 Enable sandboxed V8 for code mode @copyberry - 36378 Load local session pickers from the state DB first @copyberry - 36380 Add thread section management APIs @copyberry - 36384 Load turn summaries with paginated queries @copyberry - 36385 Add acknowledged user message submission to core @copyberry - 36388 Track image preparation details in turn analytics @copyberry - 36389 Enforce single-writer ownership for all thread histories @copyberry - 36393 Avoid redundant filesystem probes @copyberry - 36402 Declare the experimental plugin search API @copyberry - 36408 Allow custom Codex instructions for realtime transitions @copyberry - 36409 Implement remote plugin search @copyberry - 36410 Make user input blocking behavior explicit @copyberry - 36411 Use Git repositories as pre-tool hook test markers @copyberry - 36413 Add a realtime delegation acknowledgement control @copyberry - 36440 Extract exec-server request dispatching @copyberry - 36482 Avoid querying terminal size on every TUI redraw @copyberry - 36485 Increase remote plugin bundle size limits @copyberry - 36507 Retain attempted tool metadata across prompts @copyberry - 36511 Support two-stroke TUI key chords @copyberry - 36534 Raise the MCP catalog item limit to 2,048 @copyberry - 36544 Support portable Agent Plugins throughout installation @copyberry - 36632 Preserve SQLite thread metadata during goal mutations @copyberry - 36635 Expose onboarding hints in login completion notifications @copyberry - 36641 Capture rollout budget units from response usage @copyberry - 36715 Use provider-reported rollout budget units @copyberry - 36716 Deduplicate MCP resource operation handling @copyberry - 36727 Simplify turn metadata state ownership @copyberry - 36729 Correlate code mode tool analytics with model responses @copyberry - 36732 Stabilize the cloud environment HTTP test @copyberry - 36734 Deduplicate MCP resource list handling @copyberry - 36740 Store turn skill state in extension data @copyberry - 36742 Simplify contextual user fragment registration @copyberry - 36744 Store the extension registry directly in its builder @copyberry - 36745 Consolidate applypatch runtime execution @copyberry - 36757 Wait for patch events before reading shell snapshots @copyberry - 36759 Harden the TUI focus palette regression test @copyberry - 36764 Avoid building code-mode definitions during registration @copyberry - 36769 Stabilize the startup Git enrichment integration test @copyberry - 36770 Stabilize deferred goal fork testing @copyberry - 36771 Harden Linux managed proxy helper lifecycles @copyberry - 36772 Raise the host-owned Codex Apps catalog limit @copyberry - 36773 Derive the active user config layer from the layer stack @copyberry - 36774 Clarify config layer iteration APIs @copyberry - 36779 Stabilize network policy event capture in concurrent tests @copyberry - 36781 Add per-surface MCP tool exposure controls @copyberry - 36782 Add Guardian session reuse and interruption tests @copyberry - 36787 Consolidate model instructions in ModelMessages @copyberry - 36792 Gate plugin usage instructions by model capability @copyberry - 36793 Terminate timed-out Git process trees @copyberry - 36796 Add Agent Plugins MCP config parsing @copyberry - 36797 Normalize rustyv8 checksum manifest line endings @copyberry - 36800 Avoid reinjecting permissions after command approvals @copyberry - 36807 Extract audio preparation into a utility crate @copyberry - 36808 Prefer SQLite names for local session archive commands @copyberry - 36809 Prefer the state database for exec resume --last @copyberry - 36810 Add MCP client conformance regression gates @copyberry - 36811 Honor per-environment login shell policy @copyberry - 36812 Add a dual-WebSocket transport for code mode @copyberry - 36815 Identify agents by name in token budget context @copyberry - 36822 Fix typo in approval resolver name @copyberry - 36825 Consolidate approval telemetry context @copyberry - 36830 Time out stalled code-mode host requests @copyberry - 36834 Avoid requesting key-release events in Ghostty @copyberry - 36840 Keep API request metrics out of Statsig exports @copyberry - 36856 Support deferred loading for freeform tools @copyberry - 36857 Support custom tools in namespaces @copyberry - 36862 Consolidate thread spawning behind a request object @copyberry - 36871 Parallelize R2 asset publishing with DotSlash @copyberry - 36877 Move executor skill bundle loading into the skills extension @copyberry - 36880 Move direct executor skill discovery into the skills extension @copyberry - 36882 Preserve complete MCP namespace descriptions @copyberry - 36884 Add host skill root loading @copyberry - 36892 Support leaf models in multi-agent v2 @copyberry - 36893 Redact secrets from app-server command execution items @copyberry - 36895 Handle late MCP startup results after lag timeout @copyberry - 36898 Avoid redundant filesystem metadata probes @copyberry - 36900 Register app tools independently of the connector list @copyberry - 36901 Propagate updated permissions to review threads @copyberry - 36903 Load skill interface metadata in the host loader @copyberry - 36904 Limit RMCP logs persisted to SQLite @copyberry - 36906 Preserve model providers when reloading v2 agents @copyberry - 36908 Improve bearer token secret redaction @copyberry - 36910 Negotiate MCP extensions per app-server session @copyberry - 36912 Read approval policy from the current turn configuration @copyberry - 36913 Move skill policy resolution into codex-skills @copyberry - 36916 Centralize app enabled-state evaluation @copyberry - 36917 Test explicit plugin mentions with disabled apps @copyberry - 36919 Merge local plugins into plugin search results @copyberry - 36921 Move the host skills service into the skills extension @copyberry - 36924 Reject implicitly discovered bare Git repositories @copyberry - 36930 Read turn permissions from the current configuration @copyberry - 36935 Trust undecided local projects automatically @copyberry - 36938 Enable cached web search for Amazon Bedrock @copyberry - 36939 Include policy approval reasons in Guardian reviews @copyberry - 36941 Use current session settings for review threads @copyberry - 36943 Move host skill root resolution into the skills extension @copyberry - 36945 Grant the blob size policy job read access to contents @copyberry - 36947 Accept user input when starting idle turns @copyberry - 36948 Paginate transcript history in the TUI @copyberry - 36949 Improve paginated TUI history loading @copyberry - 36950 Paginate TUI transcript history @copyberry - 36951 Harden paginated history handling in the TUI @copyberry - 36952 Add durable per-thread user submission queues @copyberry - 36954 Add tool registry collision policy configuration @copyberry - 36956 Keep image resize notices attached during remote compaction @copyberry - 36959 Track connectors detected in external agent sessions @copyberry - 36960 Prompt before trusting local project directories @copyberry - 36963 Link Codex attribution in pull request bodies @copyberry - 36964 Preserve working directories when importing external sessions @copyberry - 36966 Allow disabling the built-in image viewer @copyberry - 36967 Skip symlinks when installing plugins @copyberry - 36970 Make token budget context identity configurable @copyberry - 36976 Honor explicit-only orchestrator skills @copyberry - 36977 Improve connector detection for migrated sessions @copyberry - 36979 Add Fence auditing to the blob size workflow @copyberry - 36981 Enable remote compaction for Amazon Bedrock @copyberry - 36983 Preserve ChatGPT auth for trusted staging MCP servers @copyberry - 36984 Support configured ChatGPT cookies in HTTP clients @copyberry - 36986 Add process-scoped PSP routing for ChatGPT requests @copyberry - 36987 Add opt-in concurrent exec-server request dispatch @copyberry - 36989 Preserve shared bundled skill caches @copyberry - 36990 Remove legacy collaboration mode variants @copyberry - 36992 Allow injecting model catalog caches @copyberry - 36993 Support includeTurns reads for paginated threads @copyberry - 36998 Support deferred custom tools in tool search @copyberry - 37000 Keep shared skill caches fresh across plugin loads @copyberry - 37020 Enforce strict tool name collision errors @copyberry - 37022 Canonicalize default tools under the functions namespace @copyberry - 37027 Enforce Agent Plugin runtime boundaries @copyberry - 37031 Apply permission profile updates to future turn environments @copyberry - 37035 Align registry tests with canonical tool names @copyberry - 37038 Use turn environment permissions for tool execution @copyberry - 37040 Use turn environment permissions for context and discovery @copyberry - 37053 Reject conflicting namespace descriptions in strict tool mode @copyberry - 37055 Add safer TUI defaults for cyber models @copyberry - 37066 Preserve longer MCP source descriptions in tool search @copyberry - 37068 Fall back to per-process MCP cleanup on macOS @copyberry - 37083 Consolidate unified exec output state @copyberry - 37101 Reuse stable MCP bindings across sampling steps @copyberry - 37103 Use Luna for API-key Guardian reviews @copyberry - 37109 Bound interactive telemetry shutdown @copyberry - 37114 Add per-session code-mode execution limits @copyberry - 37128 Centralize tool approval handling in Session @copyberry - 37129 Make Windows path URI comparisons ASCII-case-insensitive @copyberry - 37132 Enforce managed authentication requirements locally @copyberry - 37134 Report prompt image resizing to the model @copyberry - 37144 Preserve discovery paths for symlinked skills @copyberry - 37145 Gate Apps usage instructions by model capability @copyberry - 37147 Track provisioned environment state across registration @copyberry - 37149 Project orchestrator skills through world state @copyberry - 37151 Coalesce concurrent Git status scans @copyberry - 37154 Use Azure Key Vault for macOS notarization @copyberry - 37156 Test remote environments reported ready before selection @copyberry - 37157 Harden named session lookup in the TUI @copyberry - 37162 Load host skill roots through the skills extension @copyberry - 37166 Keep textarea cursors and rendering inside the viewport @copyberry - 37167 Expose session sources to MCP contributors @copyberry - 37168 Bound remote MCP handshake HTTP requests @copyberry - 37169 Move plugin skill snapshot integration tests into core @copyberry - 37174 Centralize skill invocation helpers in codex-skills @copyberry - 37175 Add legacy rollout migration to paginated history @copyberry - 37177 Move explicit skill selection into the skills crate @copyberry - 37178 Preserve image transparency metadata in app-server items @copyberry - 37188 Reserve the toolsearch namespace for the search tool @copyberry - 37189 Track multi-agent usage hints in world state @copyberry

View original release

Other Recent OpenAI Codex CLI Releases

• rust-v0.146.0 (July 29, 2026)
• rust-v0.145.0 (July 21, 2026)
• rust-v0.144.6 (July 18, 2026)
• rust-v0.144.5 (July 16, 2026)
• rust-v0.144.4 (July 14, 2026)

All OpenAI Codex CLI releases · All AI coding tool releases on Havoptic